{"id":"EEF-CVE-2026-66293","summary":"XML comment injection in Saxy encoder via unescaped double hyphen","details":"## Summary\n\nXML injection in the encoder of Saxy. `Saxy.Encoder` does not neutralize the `--` sequence in XML comment content: `escape_comment/2` returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single `-`, so neither an interior `--` nor a full `--\u003e` is escaped or rejected before the encoder wraps the content in the `\u003c!--` and `--\u003e` delimiters.\n\nWhen an application serializes attacker-controlled text as a comment, through `Saxy.XML.comment/1` or a raw `{:comment, text}` simple form child, the attacker can close the comment early with `--\u003e` and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.\n\nThis issue affects saxy: from 0.7.0 before 1.7.0.\n\n## Workarounds\n\nReject or rewrite the `--` sequence in untrusted text before passing it to `Saxy.XML.comment/1`, for example by replacing `--` with `- -`.\n\nAlternatively, stop emitting untrusted data as XML comments. Comments carry no semantic payload for consumers, so the text can usually be moved into an element or a CDATA section instead.\n\n## Configurations\n\nOnly applications that place untrusted text into an XML comment node are affected. The untrusted value must reach `Saxy.XML.comment/1` or a raw `{:comment, text}` simple form child that is then serialized with `Saxy.encode!/2` or `Saxy.encode_to_iodata!/2`. Documents that are only parsed by Saxy never reach the encoder and are not a vector.","aliases":["CVE-2026-66293","GHSA-mm3m-xwmf-v698"],"modified":"2026-11-06T10:41:07.048263633Z","published":"2026-11-06T10:16:42.053Z","database_specific":{"capec_ids":["CAPEC-250"],"cpe_ids":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-91"]},"references":[{"type":"ADVISORY","url":"https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-66293.html"},{"type":"WEB","url":"https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690"},{"type":"FIX","url":"https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41"},{"type":"PACKAGE","url":"https://hex.pm/packages/saxy"}],"affected":[{"package":{"name":"saxy","ecosystem":"Hex","purl":"pkg:hex/saxy"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.0"},{"fixed":"1.7.0"}]}],"versions":["0.10.0","0.7.0","0.8.0","0.9.0","0.9.1","1.0.0","1.1.0","1.2.0","1.2.1","1.2.2","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-66293.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/qcam/saxy","events":[{"introduced":"7266632e9407842f28ffac254c56dc41210a5690"},{"fixed":"6d12ee12b9e32e86ef598b3f3cafccd1840b2f41"}]}],"versions":["v1.6.1","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.2","v1.2.1","v1.2.0","v1.1.0","v1.0.0","v0.10.0","v0.9.1","v0.8.0","v0.7.0"],"database_specific":{"source":"https://cna.erlef.org/osv/EEF-CVE-2026-66293.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N"}],"credits":[{"name":"Peter Ullrich","type":"FINDER"},{"name":"Peter Ullrich","type":"REPORTER"},{"name":"Peter Ullrich","type":"REMEDIATION_DEVELOPER"},{"name":"Cẩm Huỳnh","type":"REMEDIATION_REVIEWER"},{"name":"Jonatan Männchen / EEF","type":"ANALYST"},{"name":"Peter Ullrich","type":"COORDINATOR"}]}